Executive brief
Mithril is a popular JavaScript framework used to build web applications. A prototype pollution vulnerability in its query string parsing function allows attackers to modify core JavaScript object behavior, potentially affecting all objects in the application. This could lead to application malfunction, data corruption, or enable further attacks on users of affected web applications.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in mithril's parseQueryString function. An attacker can craft a malicious query string with payloads like __proto__[toString]=123 to modify the Object prototype, altering or adding properties that will exist on all objects in the JavaScript runtime. The attack requires the vulnerable code path to be reachable via user-controlled URL query parameters. Mithril 1.x versions before 1.1.7 and 2.x versions before 2.0.2 are affected; patched versions are available in both branches.
Affected products
- Mithril mithril before 1.1.7 and 2.0.0 through 2.0.1
Timeline
- 2020-09-03: disclosed